media: info leak in __media_device_enum_links()

commit c88e739b1fad662240e99ecbd0bdaac871717987 upstream.

These structs have holes and reserved struct members which aren't
cleared.  I've added a memset() so we don't leak stack information.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index 298703f..dfc3389 100644 (file)
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -142,6 +142,8 @@ static long media_device_enum_links(struct media_device *mdev,
 
                for (p = 0; p < entity->num_pads; p++) {
                        struct media_pad_desc pad;
 
                for (p = 0; p < entity->num_pads; p++) {
                        struct media_pad_desc pad;

+
+                       memset(&pad, 0, sizeof(pad));

                        media_device_kpad_to_upad(&entity->pads[p], &pad);
                        if (copy_to_user(&links.pads[p], &pad, sizeof(pad)))
                                return -EFAULT;
                        media_device_kpad_to_upad(&entity->pads[p], &pad);
                        if (copy_to_user(&links.pads[p], &pad, sizeof(pad)))
                                return -EFAULT;


@@ -159,6 +161,7 @@ static long media_device_enum_links(struct media_device *mdev,
                        if (entity->links[l].source->entity != entity)
                                continue;
 
                        if (entity->links[l].source->entity != entity)
                                continue;
 

+                       memset(&link, 0, sizeof(link));

                        media_device_kpad_to_upad(entity->links[l].source,
                                                  &link.source);
                        media_device_kpad_to_upad(entity->links[l].sink,
                        media_device_kpad_to_upad(entity->links[l].source,
                                                  &link.source);
                        media_device_kpad_to_upad(entity->links[l].sink,